A flaw in the Janet compiler’s janetc_pop_funcdef routine allows an out‑of‑bounds read, exposing memory contents in the process. The vulnerability is a typical buffer overread type (CWE‑119, CWE‑125) that can leak sensitive data without modifying it. The attack requires local privilege and does not directly trigger code execution or denial of service.

Janet-lang’s Janet interpreter, versions up to 1.40.1, including the 1.40.x releases and any builds that incorporate the unpatched commit. The issue resides in src/core/compile.c and has been fixed by commit 4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5.

The CVSS score of 4.8 indicates low‑medium severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Because the exploit requires local execution, it is unlikely to be leveraged remotely, but it remains a concern for environments where untrusted code may run under local privileges.